From 9ad5b773f78aade2ec40c8537348e0e653400e2c Mon Sep 17 00:00:00 2001
From: Antoine Musso <hashar@users.mediawiki.org>
Date: Sat, 5 Mar 2011 16:15:39 +0000
Subject: [PATCH] Tests for bug 27854 - Http::isValidURI is to lax

Those tests are made to help someone fix bug 27854. You might want to add
some more.  Please note we want this function to only validate curl supported
URI, hence the hardcoded protocols http,https and ftp.

Some of those tests currently fail because of bug 27854.
---
 tests/phpunit/includes/HttpTest.php | 81 +++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/tests/phpunit/includes/HttpTest.php b/tests/phpunit/includes/HttpTest.php
index 719df0bf4a..5d86952687 100644
--- a/tests/phpunit/includes/HttpTest.php
+++ b/tests/phpunit/includes/HttpTest.php
@@ -522,4 +522,85 @@ class HttpTest extends MediaWikiTestCase {
 		Http::$httpEngine = 'curl';
 		$this->runCookieRequests();
 	}
+
+	/**
+	 * Test Http::isValidURI()
+	 * @bug 27854 : Http::isValidURI is to lax
+	 *@dataProvider provideURI */
+	function testIsValidUri( $expect, $URI, $message = '' ) {
+		$this->assertEquals(
+			$expect,
+			(bool) Http::isValidURI( $URI ),
+			$message
+		);
+	}
+
+	/**
+	 * Feeds URI to test a long regular expression in Http::isValidURI
+	 */
+	function provideURI() {
+		/** Format: 'boolean expectation', 'URI to test', 'Optional message' */
+		return array(
+			array( false, '¿non sens before!! http://a', 'Allow anything before URI' ),
+
+			# (ftp|http|https) - only three schemes allowed 
+			array( true,  'http://www.example.org/' ),
+			array( true,  'https://www.example.org/' ),
+			array( true,  'ftp://www.example.org/' ),
+			array( true,  'http://www.example.org', 'URI without directory' ),
+			array( true,  'http://a', 'Short name' ),
+			array( true, 'http://étoile', 'Allow UTF-8 in hostname' ),  # 'étoile' is french for 'star'
+			array( false, '\\host\directory', 'CIFS share' ),
+			array( false, 'gopher://host/dir', 'Reject gopher scheme' ),
+			array( false, 'telnet://host', 'Reject telnet scheme' ),
+			
+			# :\/\/ - double slashes
+			array( false,  'http//example.org', 'Reject missing column in protocol' ),
+			array( false,  'http:/example.org', 'Reject missing slash in protocol' ),
+			array( false,  'http:example.org', 'Must have two slashes' ),
+			# Following fail since hostname can be made of anything
+			array( false,  'http:///example.org', 'Must have exactly two slashes, not three' ),
+
+			# (\w+:{0,1}\w*@)? - optional user:pass
+			array( true,  'http://user@host', 'Username provided' ),
+			array( true,  'http://user:@host', 'Username provided, no password' ),
+			array( true,  'http://user:pass@host', 'Username and password provided' ),
+
+			# (\S+) - host part is made of anything not whitespaces
+			array( false, 'http://!"èèè¿¿¿~~\'', 'hostname is made of any non whitespace' ),
+			array( false, 'http://exam:ple.org/', 'hostname can not use columns!' ),
+
+			# (:[0-9]+)? - port number
+			array( true, 'http://example.org:80/' ),
+			array( true, 'https://example.org:80/' ),
+			array( true, 'http://example.org:443/' ),
+			array( true, 'https://example.org:443/' ),
+			array( true, 'ftp://example.org:1/', 'Minimum' ),
+			array( true, 'ftp://example.org:65535/', 'Maximum port number' ),
+
+			# Part after the hostname is / or / with something else
+			array( true, 'http://example/#' ),
+			array( true, 'http://example/!' ),
+			array( true, 'http://example/:' ),
+			array( true, 'http://example/.' ),
+			array( true, 'http://example/?' ),
+			array( true, 'http://example/+' ),
+			array( true, 'http://example/=' ),
+			array( true, 'http://example/&' ),
+			array( true, 'http://example/%' ),
+			array( true, 'http://example/@' ),
+			array( true, 'http://example/-' ),
+			array( true, 'http://example//' ),
+			array( true, 'http://example/&' ),
+
+			# Fragment
+			array( true, 'http://exam#ple.org', ),  # This one is valid, really!
+			array( true, 'http://example.org:80#anchor' ),
+			array( true, 'http://example.org/?id#anchor' ),
+			array( true, 'http://example.org/?#anchor' ),
+
+			array( false, 'http://a ¿non !!sens after', 'Allow anything after URI' ),
+		);
+	}
+
 }
-- 
2.20.1